fix(loop): rebuild-semantics pattern registry + estate-rescan workflow + FP classifications by hyperpolymath · Pull Request #458 · hyperpolymath/hypatia

hyperpolymath · 2026-06-11T22:26:11Z

The most significant error in the security report was the report

Audit of the canonical scan store (verisimdb-data) against current repo state found:

Stale: the majority of recorded Critical/High findings referenced files deleted months ago (hypatia deploy/ scripts, registry/, standards *-scm/.../Foreign.idr) or content already fixed (verisimdb src/abi/Foreign.idr has no believe_me). Scans were last truly refreshed ~2026-03 by manual local runs (/var$REPOS_DIR literal in the recorded paths is an unexpanded-variable artifact of that flow).
Pre-suppression schema: the stored scans predate panic-attack's kanren/context/classification FP-suppression entirely (no suppressed field), so remediation scripts, detector test fixtures and env-default bindings were recorded as Criticals.
Append-only registry: sync_from_scans re-added the same weak_points on every run (counts inflated multiplicatively) and never removed a repo from repos_affected_list — so even a perfect fix never moved the numbers, and the fleet kept dispatching against phantom findings.
Coverage: vcl-ut and bag-of-actions had no scan at all.

Fixes

PatternRegistry.sync_from_scans/1 — rebuild, not append: per-repo repo_occurrences map as source of truth; scanned repos rebuilt, unscanned repos carried; vanished patterns become trend: "resolved" with empty repo lists (TriangleRouter then dispatches nothing for them); suppressed weak_points rejected at intake (panic-attack's documented consumer contract); heuristic UnboundedAllocation capped at Medium (one keyword matcher hardcoded to Severity::Critical upstream was ~70% of all estate Criticals — cap mirrors the license_finding_severity_cap precedent). Legacy entries migrate; 6 new tests cover suppression, capping, no-inflation, partial-sync carry, resolution, identity preservation.
estate-rescan.yml: daily + workflow_dispatch + repository_dispatch(estate-rescan) central rescan — builds current panic-attack (SHA-keyed cache), scans all public, non-archived, non-fork org repos (007* excluded per owner policy; public-only so no private findings can land in the public store), normalizes program_path to the repo name, regenerates index.json (active/suppressed/critical/high counts, summaries preserved), pushes to verisimdb-data with HYPATIA_DISPATCH_PAT under a serialized concurrency group with rebase-retry. Fixes freshness, FP-schema, and coverage in one place. gitbot-fleet PR #(companion) fires the targeted dispatch after fixes land.
audits/assail-classifications.a2ml (panic-attack's sanctioned audited-FP registry): soundness-gate negative fixtures, remediation script, env-default ${VAR:-} binding, test credentials, suppression-rule definitions, documented client FFI unsafe. Plus triage_issues.parse_classes no longer atomizes CLI input (PA013).

Verification

Fresh panic-attack 2.5.5 scans run locally this session:

repo	stale store C/H	fresh, after this work (non-heuristic C/H)
hypatia	10/4	0
gitbot-fleet	6/2	0
standards	3/0	0
verisimdb	3/0	0
vcl-ut	no scan	0

Rebuild semantics verified by local harness (suppression, cap, no-inflation, partial carry, resolution, legacy migration all pass) + the new ExUnit tests for CI.

After merge

Trigger estate-rescan.yml once via workflow_dispatch — the refreshed store + rebuilt registry flush every phantom finding estate-wide, and the resolved trend starts showing in the numbers immediately.

https://claude.ai/code/session_01EzjC8MEx3Kzf3pdMhaQSks

Generated by Claude Code

…w + FP classifications The security reports the whole pipeline reasons over were stale and inflated, so nothing ever resolved and the fleet dispatched fixes for findings that no longer existed. Three coordinated fixes: 1. PatternRegistry.sync_from_scans/1 rebuilds per-repo state instead of appending: per-repo repo_occurrences as source of truth, suppressed weak_points rejected at intake (panic-attack consumer contract), vanished patterns marked trend=resolved with empty repo lists (so TriangleRouter dispatches nothing for them), heuristic UnboundedAllocation capped at Medium (one keyword matcher was ~70% of estate Criticals). Legacy entries migrate; inflated counts reset on first rebuild. New active_patterns/0 helper + 6 new tests. 2. estate-rescan.yml: daily + on-demand central rescan of all public org repos with current panic-attack, pushing refreshed scans and a regenerated index to verisimdb-data via HYPATIA_DISPATCH_PAT. Replaces the manual-local scan flow that left scans/ frozen at 2026-03 (with phantom Criticals for files deleted months ago) and never covered vcl-ut/bag-of-actions. repository_dispatch type estate-rescan lets gitbot-fleet flush fixed repos immediately. 3. audits/assail-classifications.a2ml: audited-FP registry for hypatia's own scan (soundness fixtures, remediation scripts, env-default binding, doc/test credentials, documented FFI unsafe). Plus: triage_issues parse_classes no longer atomizes CLI input (PA013) — resolves against the known-class table. Verified locally with panic-attack 2.5.5: hypatia unsuppressed non-heuristic Critical/High count is now 0 (was 19 Critical / 5 High in the stale store).

github-actions · 2026-06-11T22:27:07Z

🔍 Hypatia Security Scan

Findings: 55 issues detected

Severity	Count
🔴 Critical	0
🟠 High	0
🟡 Medium	55

View findings

[
  {
    "reason": "Action urin 21 JRE\n        uses: actions/setup-java@be666c2fcd27 needs attention",
    "type": "unpinned_action",
    "file": "verify-proofs.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in governance.yml",
    "type": "missing_timeout_minutes",
    "file": "governance.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in hypatia-scan.yml",
    "type": "missing_timeout_minutes",
    "file": "hypatia-scan.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in mirror.yml",
    "type": "missing_timeout_minutes",
    "file": "mirror.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in scorecard.yml",
    "type": "missing_timeout_minutes",
    "file": "scorecard.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in secret-scanner.yml",
    "type": "missing_timeout_minutes",
    "file": "secret-scanner.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "codeql_missing_actions_language",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Repository has 6 non-main remote branch(es). Policy: single main branch only.",
    "type": "GS007",
    "file": ".",
    "action": "delete_remote_branches",
    "rule_module": "git_state",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 9 day(s) old",
    "type": "CSA001",
    "file": "src/ui/gossamer/README.adoc",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 9 day(s) old",
    "type": "CSA001",
    "file": "scripts/ci-tools/Cargo.toml",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

…w + FP classifications The security reports the whole pipeline reasons over were stale and inflated, so nothing ever resolved and the fleet dispatched fixes for findings that no longer existed. Three coordinated fixes: 1. PatternRegistry.sync_from_scans/1 rebuilds per-repo state instead of appending: per-repo repo_occurrences as source of truth, suppressed weak_points rejected at intake (panic-attack consumer contract), vanished patterns marked trend=resolved with empty repo lists (so TriangleRouter dispatches nothing for them), heuristic UnboundedAllocation capped at Medium (one keyword matcher was ~70% of estate Criticals). Legacy entries migrate; inflated counts reset on first rebuild. New active_patterns/0 helper + 6 new tests. 2. estate-rescan.yml: daily + on-demand central rescan of all public org repos with current panic-attack, pushing refreshed scans and a regenerated index to verisimdb-data via HYPATIA_DISPATCH_PAT. Replaces the manual-local scan flow that left scans/ frozen at 2026-03 (with phantom Criticals for files deleted months ago) and never covered vcl-ut/bag-of-actions. repository_dispatch type estate-rescan lets gitbot-fleet flush fixed repos immediately. 3. audits/assail-classifications.a2ml: audited-FP registry for hypatia's own scan (soundness fixtures, remediation scripts, env-default binding, doc/test credentials, documented FFI unsafe). Plus: triage_issues parse_classes no longer atomizes CLI input (PA013) — resolves against the known-class table. Verified locally with panic-attack 2.5.5: hypatia unsuppressed non-heuristic Critical/High count is now 0 (was 19 Critical / 5 High in the stale store).

github-actions · 2026-06-11T22:34:19Z

🔍 Hypatia Security Scan

Findings: 55 issues detected

Severity	Count
🔴 Critical	0
🟠 High	0
🟡 Medium	55

View findings

[
  {
    "reason": "Action urin 21 JRE\n        uses: actions/setup-java@be666c2fcd27 needs attention",
    "type": "unpinned_action",
    "file": "verify-proofs.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in governance.yml",
    "type": "missing_timeout_minutes",
    "file": "governance.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in hypatia-scan.yml",
    "type": "missing_timeout_minutes",
    "file": "hypatia-scan.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in mirror.yml",
    "type": "missing_timeout_minutes",
    "file": "mirror.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in scorecard.yml",
    "type": "missing_timeout_minutes",
    "file": "scorecard.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in secret-scanner.yml",
    "type": "missing_timeout_minutes",
    "file": "secret-scanner.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "codeql_missing_actions_language",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Repository has 6 non-main remote branch(es). Policy: single main branch only.",
    "type": "GS007",
    "file": ".",
    "action": "delete_remote_branches",
    "rule_module": "git_state",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 9 day(s) old",
    "type": "CSA001",
    "file": "src/ui/gossamer/README.adoc",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 9 day(s) old",
    "type": "CSA001",
    "file": "scripts/ci-tools/Cargo.toml",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

…#382) Part of the estate loop repair (hyperpolymath/hypatia#458). Extends the existing classification registry (v1.0.0 → v1.1.0, house style preserved) with the audited residuals from a fresh panic-attack 2.5.5 scan of standards — every entry inspected at source this session: - **bench/audit harnesses** that `eval` their own embedded command tables (`k9-svc/benchmarks/k9-bench.sh`, `a2ml/benchmarks/parser-bench.sh`, `rhodium-standard-repositories/rsr-audit.sh`) — no external input reaches the eval; - **BoF presentation demo scripts** (palimpsest-license satellites); - **demo/example code** (`avow-protocol/public/demo.js`, `avow-lib/examples/`); - **build-time pandoc Lua filter** (`a2ml/pandoc/a2ml-filter.lua`); - **audited Zig FFI boundary casts** (`overlay-protocol/ffi`, `lol/ffi`) — mirrors the 007 `zig_bridge.rs` reference classification; - **ReScript compiler output** (`axel-protocol/src/Tea.res.js`). With these, standards' unsuppressed non-heuristic Critical/High = **0**. The stale verisimdb-data store showed 3 Criticals for `*-scm/src/abi/Foreign.idr` files that **no longer exist** — flushed by the estate-rescan workflow in hypatia#458. https://claude.ai/code/session_01EzjC8MEx3Kzf3pdMhaQSks --- _Generated by [Claude Code](https://claude.ai/code/session_01EzjC8MEx3Kzf3pdMhaQSks)_ Co-authored-by: Claude <noreply@anthropic.com>

…ge carve-outs + A2ML gate dialect fix Three scanner-precision fixes, each killing an estate-wide FP class observed live on this PR's own scan comments (and verisimdb#123 / standards#382): 1. Byte-vs-grapheme slicing: every `Regex.scan(..., return: :index)` consumer sliced with String.slice/3, which counts graphemes while the regex engine returns BYTE offsets. Any multi-byte character earlier in a file (em-dash in a comment) shifted every later slice: mangled duplicate findings ("tions/checkout@...", "urin 21 JRE"), and SHA-pinned actions flagged as unpinned because the shifted slug failed the 40-hex exemption. BH004 even sent the mangled owner/repo + sha to the GitHub API. Fixed across workflow_hardening (WH004/5/ 10/11), baseline_health (BH004), research_extensions (RE004/7/8/9) with binary_part/3 plus a clamped, UTF-8-boundary-safe byte_preview helper for fixed-length excerpts. Regression test included. 2. banned_language_file now honours the CicdRules path_allow_prefixes as the single source of truth for the CLAUDE.md exemption tables. The hand-copied @banned_lang_ts_carveouts list had drifted to 3 of the ~12 documented carve-outs, so k9-svc/bindings/deno/mod.ts was flagged Critical on standards#382 despite its documented interop exemption. Python/Go stay hard-refused (total bans). Tests included. 3. dogfood-gate A2ML validation: audits/assail-classifications.a2ml is panic-attack's user-classification registry — an S-expression dialect per that tool's spec, not the TOML-like manifest A2ML the gate validates. Excluded via the action's paths-ignore (defaults restated — a custom value replaces them). Also adds the REUSE copyright line to the registry.

…963/git/hyperpolymath/hypatia into claude/admiring-dijkstra-cdu2rl # Conflicts: # audits/assail-classifications.a2ml

github-actions · 2026-06-11T22:44:09Z

🔍 Hypatia Security Scan

Findings: 55 issues detected

Severity	Count
🔴 Critical	0
🟠 High	0
🟡 Medium	55

View findings

[
  {
    "reason": "Action urin 21 JRE\n        uses: actions/setup-java@be666c2fcd27 needs attention",
    "type": "unpinned_action",
    "file": "verify-proofs.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in governance.yml",
    "type": "missing_timeout_minutes",
    "file": "governance.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in hypatia-scan.yml",
    "type": "missing_timeout_minutes",
    "file": "hypatia-scan.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in mirror.yml",
    "type": "missing_timeout_minutes",
    "file": "mirror.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in scorecard.yml",
    "type": "missing_timeout_minutes",
    "file": "scorecard.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in secret-scanner.yml",
    "type": "missing_timeout_minutes",
    "file": "secret-scanner.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "codeql_missing_actions_language",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Repository has 6 non-main remote branch(es). Policy: single main branch only.",
    "type": "GS007",
    "file": ".",
    "action": "delete_remote_branches",
    "rule_module": "git_state",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 9 day(s) old",
    "type": "CSA001",
    "file": "src/ui/gossamer/README.adoc",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 9 day(s) old",
    "type": "CSA001",
    "file": "scripts/ci-tools/Cargo.toml",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

hyperpolymath mentioned this pull request Jun 11, 2026

fix(abi): close last Tier2 assert_total via fuel recursion + FP classifications hyperpolymath/vcl-ut#56

Merged

hyperpolymath force-pushed the claude/admiring-dijkstra-cdu2rl branch from 211e67e to 4f4ef33 Compare June 11, 2026 22:32

hyperpolymath marked this pull request as ready for review June 11, 2026 22:34

hyperpolymath enabled auto-merge (rebase) June 11, 2026 22:35

claude added 2 commits June 11, 2026 22:42

Merge branch 'claude/admiring-dijkstra-cdu2rl' of http://127.0.0.1:45…

25b4a20

…963/git/hyperpolymath/hypatia into claude/admiring-dijkstra-cdu2rl # Conflicts: # audits/assail-classifications.a2ml

hyperpolymath disabled auto-merge June 11, 2026 23:29

hyperpolymath enabled auto-merge (squash) June 11, 2026 23:38

hyperpolymath disabled auto-merge June 12, 2026 11:19

hyperpolymath merged commit dbdb17d into main Jun 12, 2026
14 checks passed

hyperpolymath deleted the claude/admiring-dijkstra-cdu2rl branch June 12, 2026 11:21

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(loop): rebuild-semantics pattern registry + estate-rescan workflow + FP classifications - #458

fix(loop): rebuild-semantics pattern registry + estate-rescan workflow + FP classifications#458
hyperpolymath merged 4 commits into
mainfrom
claude/admiring-dijkstra-cdu2rl

hyperpolymath commented Jun 11, 2026

Uh oh!

github-actions Bot commented Jun 11, 2026

Uh oh!

github-actions Bot commented Jun 11, 2026

Uh oh!

github-actions Bot commented Jun 11, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

hyperpolymath commented Jun 11, 2026

The most significant error in the security report was the report

Fixes

Verification

After merge

Uh oh!

github-actions Bot commented Jun 11, 2026

🔍 Hypatia Security Scan

Uh oh!

github-actions Bot commented Jun 11, 2026

🔍 Hypatia Security Scan

Uh oh!

github-actions Bot commented Jun 11, 2026

🔍 Hypatia Security Scan

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants